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Remarks 

The specification is being amended properly to identify the related application. 

Claims 1 to 2 1» all of the prior claims, are being cancelled and new claims 22 - 27 
submitted in their stead 

The Examiner had rejected certain of the original claims, 35 USC 112, first paragraph, 
with respect to the language in those claims of, as in claim I," detemuning if any of the bits 
attempted to be written to the memory are transmiued to someplace other than the memory''. 
That language had been replaced in the new claims by language, as in new claim 22, "identifying 

the existence of one or more unknown programs or if any of the bits attempted to be written 

to the memory are also being improperly transmitted to a storage or other device." Applicants 
refer the Examiner to Fig. 6 of applicants' specification wherein step S630 identifies illegal 
activity if "(1) video is being transmitted from client to a storage device (hard drive), or (2) video 
is being transmitted to another device." As stated at page 15, lines 22-23 "Further, during the 
process of reading and writing bits, the spy observes the chent for any unauthorized disk 
accesses or network transactions (S630)." See also, or example, page 10, lines 16-20. with 
reference to Fig. 3, " Meanwhile the spy 210 observes all of the client's disk and network 
transactions (S320). As such, if a virus in the client 120 copies the video stream data to a file on 
the disk or transmits it over the network to another system, the spy 210 detects such activity. If 
an authorized activity is detected, the spy 210 then informs the server 110 of this unauthorized 
activity (S330) " 

The prior claims, now cancelled, were rejected by the Examiner as anticipated, 35 USC 
102(e) by Sprague et al patent 6,449,720 (hereinafter Sprague) or as unpatentable. 35 USC 
103(a) over Sprague in view of England et al patent 6,330,670 or Zhu patent 6,357,028. 
Accordingly, with respect to new claims 22-27 the main reference to be considered is Sprague. 
Applicants submit that the Examiner has read more into Sprague than is warranted 

Applicants' invention involves the use of what applicants have termed "a spy" to identify 
the existence of an unknown program in a system, such an unknown program representing a 
virus, and advising a server that a virus may have entered the system. As such in one 
embodiment of applicants' invention two determinations are made to identify the existence of 
such an unknown program; first, a predetermined number of bits are written into memory, read 
from naemory, and compared and, second, the spy determines if any of the bits are being or have 
been transmitted improperly to a device, whether in the client or on the network, other than the 
memory. The spy device itself is described, inter alia, at page 9, lines 3-27. 

Sprague is directed to using a cryptographic control unit in a system shared by multiple 
users and uses secure functions. Sprague calls these "security applets" and they are loaded into a 
control memory which runs the applets and returns the result of the secure function to a desktop 
PC. The Examiner refers to Sprague column 3, lines 9-U, as disclosing the step of writing a 
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predetermined number of bits into a memory, wherein the predetermined number of bits is based 
on the si2e of the memory. However, applicants find at that point in the Sprague disclosure that 
Sprague says merely that "the proposed security applet must be small enough to fit into outboard 
RAM on the crypto unit.'' This is not a disclosure or teaching of applicants' invention which 
involves a number of the bits in a stream and not applets. 

Further applicants' inventive method involves the identification of the existence of a 
possible virus program not only by the writing, reading, and matching of the predetermined 
number of bits from a transmitted stream of bits but also by determining (by their '*spy") if any 
of the bits attempted to be written to the memory are also being transmitted improperly to a 
storage or other device, whether within the system or on the network. For this important aspect 
of applicants' invention the Examiner has cited column 3, lines 50, 52-54 of Sprague; however, 
the full sentence at column 3, lines 50-54, reads 'Tf an unloiown application security applet is 
encountered (i.e., a security applet that has never been loaded into this particular crypto unit), the 
ROM loader control program swaps back in the native mode security applet, which establishes a 
secure communication session with the OPC." Applicants fail to sec the relevance of this 
sentence to their invention. 

New claim 22 recites applicants* inventive method for identifying by a spy device the 
existence of one or more unknown programs in a computer system if the number of bits from a 
bit stream written into memory and then read from memory do not match and also if any of the 
bits attempted to be written into memory have been improperly transmitted, not to the memory, 
but to a storage or other device. Claims 23 and 24 are dependent on claim 22, claim 23 
specifying that the bits are in a known bit stream from the spy device. 

New claim 25 recites applicants' inventive method for advising a server transmitting a 
stream of bits to a client system that a virus may have entered the system, the determination 
being made if either bits read from memory do not match bits written into memory or if any of 
the bits attempted to be read into memory have also been improperly transmitted to a storage or 
other device and» if thus determined, sending a message back to the server. 

New claim 26 recites applicants' inventive system for identifying the existence of one or 
more unknown programs in a client, the system comprising apparatus to accomplish applicants' 
inventive method, as discussed above. 

New claim 27 recites applicants' inventive computer system including a processor, 
memory, and applicants* spy device which, as recited therein, observes the computer system 
internal operations to detect improper transmission of bits to a storage or other device in the 
computer system or over a network to another computer system. Clearly Sprague has no 
disclosure Or teaching of such a combination including the recited spy device. 

Applicants submit that neither Sprague nor the secondary references relied upon by the 
Examiner disclose, teach, or suggest applicants' invention, as now more precisely recited in the 



-6- 



PA(S 1(Uir RCVD AT 1112m 2:44:57 PM [Eastern Standard 



N0V-23-04 15=04 FROM . TELCORD I A LEGAL DEPT. 



ID: 1 7323363004 



PAGE 



11/11 



Appl. No. 09/765269 



APP 1234 



Amdt. Dated 11/29/2004 
Reply to Office action of 07/30/2004 

new claims 22-27. Accordingly, favorable consideration and allowance of claims 22-27 and 
passage of this applicalion to issue arc respectfully requested. 

If the Examiner considers it would in any way expedite the prosecution of this 
application, the Examiner is invited to telephone applicants* attorney at the number set forth 
below, 

A Petition for one month Extension of Time is included. 



Respectfully submitted. 



Richard J, lipton et al 




Jiiiss W.Falk 
Ai^ttney for App 
Reg. No. 16,154 
(732) 699-4465 
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